Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2021-36942 | 7.5 | 66.0% | ✅ listed | available | 72.75 (High) |
LockFile hijacks Windows domains with PetitPotam
LockFile is a new ransomware gang first observed in July 2021, with activity confirmed as of August 20, 2021. The group has been recorded primarily in the U.S. and Asia, hitting organizations across financial services, manufacturing, engineering, legal, business services, travel, and tourism.
The attack chain begins with ProxyShell on Exchange servers for initial access, then pivots to the domain controller via PetitPotam (CVE-2021-36942). The LSA spoofing flaw forces NTLM relay to a remote server under LockFile’s control, giving the gang full domain control once the DC is taken. The CVE carries a CVSS 7.5, sits in CISA’s KEV list, and has an EPSS score of 66.0% (99th percentile), with a public PoC available.
LockFile relies on publicly available code for the original PetitPotam variant. Once the shellcode executes, it activates efspotato.exe to run the exploit, then copies the ransom payload to the DC and pushes it across the network to client hosts after authentication.
The attack chain: ProxyShell in, PetitPotam out
The first step is ProxyShell on Exchange. LockFile lands on the mail server to get a foothold, then pivots to the domain controller. The second step is where the domain falls: an encrypted shellcode activates efspotato.exe, which runs the PetitPotam exploit against the DC. The LSA spoofing flaw (CVE-2021-36942) forces NTLM relay to a remote server under LockFile’s control, giving the gang full domain control once the DC is taken.
The final step copies the LockFile payload to the local DC and pushes it across the network to client hosts via a script that runs immediately after authentication. The researchers note the attackers typically sit on the network for several days before detonating the file-encrypting malware, which is typical for this class of ransomware.
LockBit and Conti connections
Symantec notes the LockFile ransom note is "very similar" to the one used by LockBit, a direct stylistic match that suggests shared lineage or deliberate copying. The contact email left for victims is contact@contipauper[.]com — a not-so-subtle nod to Conti that the researchers flag as a deliberate reference.
The email domain choice invites speculation. LockFile looks like the project of a disgruntled Conti affiliate who leaked the gang's attack playbook, per Symantec's read on the naming convention. The researchers believe LockFile is a new actor with ties to known or retired players in the community, though they stop short of naming the specific connection.
CVE-2021-36942: the LSA spoofing flaw
CVE-2021-36942 is the Windows LSA Spoofing vulnerability, also known as PetitPotam. It carries a CVSS 7.5 (v3.1), sits in CISA’s Known Exploited Vulnerabilities list, and has an EPSS score of 66.0% at the 99th percentile. A public PoC is available.
Microsoft’s official mitigations and updates do not fully block the attack vector yet. LockFile uses publicly available code for the original PetitPotam variant, which is the one tracked under this CVE.
Key points
- LockFile uses PetitPotam (CVE-2021-36942) to relay NTLM authentication to a remote server under their control, taking over the domain controller.
- Initial access is via ProxyShell on Exchange servers, giving the attacker a foothold before domain takeover.
- Victims span U.S. and Asia across financial services, manufacturing, engineering, legal, business services, travel, and tourism sectors.
- Ransom note is nearly identical to LockBit's, and the contact email is contact@contipauper[.]com — a direct reference to Conti.
- Attackers typically linger several days on the network before detonating the file-encrypting payload, which is pushed to the DC and replicated to clients.
Further reading & sources
- LockFile ransomware uses PetitPotam attack to hijack Windows domains
- Sequel to ChainVeil npm malware: ViteVenom - Checkmarx Zero
- ChainDrop: Inside a Self-Propagating npm Worm
- pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90% | Socket
- Secure your npm and pip package updates in Amazon Linux | AWS Security Blog
- Atomsilo Ransomware | WatchGuard Technologies
- Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache | Socket
- LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection | Threatpost